OSHA regulations: what they actually require and how to comply

Last updated 2026-07-09

What are OSHA regulations and where do they come from?

OSHA, the Occupational Safety and Health Administration, came out of the Occupational Safety and Health Act of 1970 (Public Law 91-596). ^[1] That law handed the federal government authority to set and enforce workplace safety standards for the first time. Before it passed, there was no national floor for worker protection at all.

The rules themselves live in Title 29 of the Code of Federal Regulations. General industry is Part 1910. Construction is Part 1926. Maritime runs Parts 1915 through 1919. Agriculture is Part 1928. Each part splits into subparts organized by hazard: electrical, lockout/tagout, respiratory protection, hazard communication, and on down the list.

The Act also created the General Duty Clause, Section 5(a)(1), which says employers must provide a workplace "free from recognized hazards that are causing or are likely to cause death or serious physical harm." ^[1] That one sentence carries a lot of weight. It lets OSHA cite an employer even when no specific standard covers the hazard. Heat illness enforcement has run through the General Duty Clause for years because there is no finalized federal heat standard yet.

OSHA does not cover everyone. Self-employed people with no employees, immediate family on farms, and workers under other federal agencies (miners, airline crews, railroad workers) sit outside its reach. Everyone else does not. Roughly 144 million workers at 10 million workplaces fall under OSHA. ^[1]

Want the agency backstory? The what does OSHA stand for and OSHA meaning articles walk through the history and scope.

Which OSHA standards apply to my business?

It depends on your industry classification and what your people actually do all day. A small office has a short list. A sheet metal shop has a long one. Nobody can hand you a single universal checklist, because the standards attach to hazards, not to businesses.

Work through three questions to find your list:

1. What industry are you in? Your NAICS code decides whether you fall under general industry (1910), construction (1926), or another part. 2. What hazards actually exist in your operation? A retailer whose workers run forklifts is covered by 29 CFR 1910.178 (powered industrial trucks), same as any warehouse. 3. Which standards apply almost everywhere? A handful reach nearly every workplace regardless of industry: hazard communication (29 CFR 1910.1200), recordkeeping (29 CFR 1904), emergency action plans (29 CFR 1910.38), and the General Duty Clause.

OSHA's website has a compliance assistance tool you can search by industry, and its Small Business page carries sector guidance. ^[2] The tool gives you a starting list, not a finished one. A machine shop that also stores flammable liquids has to cross-reference the flammable liquids standard (29 CFR 1910.106) even when the tool never surfaces it.

Based on OSHA's annual citation data, the most cited general industry standards are hazard communication, respiratory protection (29 CFR 1910.134), lockout/tagout (29 CFR 1910.147), powered industrial trucks, and machine guarding (29 CFR 1910.212). ^[3] In construction the leaders are fall protection (29 CFR 1926.501), scaffolding (29 CFR 1926.451), ladders (29 CFR 1926.1053), and eye and face protection.

What are the most important OSHA standards for general industry?

These are the standards that generate the most citations and the most injuries, each with its CFR citation. If you run a shop, warehouse, or plant, this is your short list to check yourself against.

Standard	CFR Citation	What it covers
Hazard Communication	29 CFR 1910.1200	SDS sheets, labeling, employee training on chemicals
Lockout/Tagout	29 CFR 1910.147	Controlling hazardous energy during equipment service
Respiratory Protection	29 CFR 1910.134	Respirator fit-testing, written program, medical eval
Powered Industrial Trucks	29 CFR 1910.178	Forklift training, inspection, safe operation
Machine Guarding	29 CFR 1910.212	Guards on moving parts, point-of-operation protection
Electrical (Wiring)	29 CFR 1910.303-.308	Wiring methods, equipment, grounding
Walking-Working Surfaces	29 CFR 1910.22	Housekeeping, floors, aisles, safe clearances
Emergency Action Plans	29 CFR 1910.38	Written evacuation plan, fire response
Personal Protective Equipment	29 CFR 1910.132	Hazard assessment, PPE selection and training
Recordkeeping	29 CFR 1904	OSHA 300 log, 301 forms, annual 300A summary

Lockout/tagout sits in the top five most cited standards year after year and is linked to an estimated 50,000 injuries a year. ^[13] It gets cited so much because the written program requirement (every covered machine needs a documented energy control procedure) is easy to audit, and inspectors know exactly what a compliant one looks like.

Hazard communication lands near the top for a different reason: the requirements are detailed and easy to break. You need a written program, a current SDS for every hazardous chemical on-site, and documented training for each employee who works with or near those chemicals. Swap a cleaning solvent and forget to file its SDS, and you are out of compliance that afternoon.

For the OSHA training tied to each of these standards, there is a separate breakdown worth reading.

What are OSHA's current heat regulations?

Right now there is no finalized federal OSHA heat standard, and that gap creates real confusion for employers. OSHA published a proposed rule on heat injury and illness prevention in August 2024, but as of mid-2025 it has not been finalized. ^[4] So the rule you might expect to follow does not legally exist yet.

In the meantime, OSHA enforces heat through the General Duty Clause. The agency launched a National Emphasis Program on heat in 2022 that targets inspections in high-heat industries: agriculture, construction, warehousing, oil and gas. ^[5] Employers in those sectors are getting inspected for heat safety with no specific numeric standard on the books.

The proposed heat rule would require employers to:

• Write a heat injury and illness prevention plan once the heat index hits 80°F
• Provide cool drinking water (1 quart per worker per hour)
• Provide shaded or air-conditioned rest areas
• Allow and encourage rest breaks at a 90°F heat index (the proposed "high heat" trigger)
• Run a heat acclimatization plan for new and returning workers
• Set emergency response procedures ^[4]

Several states already have enforceable heat rules. California (8 CCR 3395) and Washington both have them. Oregon adopted emergency heat rules and later made them permanent. If you operate in a state plan state, check your state agency, because the standard may already be law where you are.

Here is the practical call for general industry employers in federal OSHA states. Follow the proposed rule's framework now, as a best practice, because that framework is the same one OSHA already uses to build General Duty Clause citations. Waiting for the final rule before you act is a live risk, not a safe default.

How much can OSHA fine a small business?

OSHA raises its penalty maximums every year for inflation under the Federal Civil Penalties Inflation Adjustment Act. For 2024, a serious violation tops out at $16,550, and a willful or repeat violation tops out at $165,514. ^[6] Those are ceilings, not the number most small employers actually pay.

Violation Type	Maximum Penalty per Violation
Other-than-Serious	$16,550
Serious	$16,550
Repeat	$165,514
Willful	$165,514
Failure to Abate	$16,550 per day

OSHA runs a penalty formula that weighs severity, probability, good faith, and size. Employers with 25 or fewer employees get up to a 60% reduction. Employers with 26 to 100 employees get up to 40%. Willful and repeat violations get far less discount room.

The numbers stack fast. Say OSHA finds 10 serious violations in one inspection and you have 50 employees, so a 30% reduction applies. You are still looking at roughly $115,000 before any settlement. Most citations do settle lower through the informal conference process, but only if you contest within 15 working days of receiving the citation. Miss that window and the penalties become final.

State plan states run their own numbers. A state plan has to be "at least as effective" as federal OSHA, but it can set its own penalty amounts. California's Cal/OSHA, for one, uses maximums that differ from the federal figures.

What does an OSHA written program actually require?

Plenty of OSHA standards demand a written program, and the requirement is specific, not vague. "We have a safety policy" is not a written program. Under OSHA, a written program is a documented procedure that covers the exact elements spelled out in the standard, element by element.

Take respiratory protection (29 CFR 1910.134). The standard requires a written program that includes procedures for selecting respirators, medical evaluations, fit testing, proper use, maintenance and storage, and training. Leave one of those out of the document and the written program requirement is not met, even if your workers are doing every one of those things in practice.

The same logic runs through:

• Hazard communication: written program plus SDS file plus training records
• Lockout/tagout: written energy control program plus machine-specific procedures
• Bloodborne pathogens (29 CFR 1910.1030): written exposure control plan, updated annually
• Emergency action plan (29 CFR 1910.38): written plan required if you have 10 or more employees
• Personal protective equipment (29 CFR 1910.132): documented hazard assessment and certification

That "10 or more employees" threshold for a written emergency action plan is worth knowing, because small shops often assume they are exempt from written programs across the board. They are not. They are exempt from a few specific documentation triggers, never from the underlying safety requirements.

Here is where SafetyFolio's safety program generator earns its keep. It builds out the required elements for each standard so you are not guessing what the document has to say. The program is only half the job, though. You still have to train your workers on it and keep the records.

For the agency-level view of what OSHA covers on down, that overview page fills in the rest.

What recordkeeping does OSHA require from small businesses?

OSHA recordkeeping lives in 29 CFR Part 1904. Most employers with 10 or more employees keep three documents: the OSHA 300 Log (injury and illness log), the OSHA 301 (incident report form, or an equivalent), and the OSHA 300A (annual summary).

The 300A has to be posted somewhere visible from February 1 through April 30 every year, signed by a company executive. ^[7]

A set of low-injury-rate industries is partially exempt from routine recordkeeping (the NAICS-based exemption list is on OSHA.gov). But exempt employers still have to report the serious stuff: any work-related fatality within 8 hours, any in-patient hospitalization of one or more workers within 24 hours, and any amputation or loss of an eye within 24 hours. ^[7] Those reporting duties apply to every covered employer, exempt from routine logging or not.

Records have to be kept for 5 years. OSHA can pull them during an inspection, and workers and their representatives have the right to see the 300 Log for their establishment.

Electronic submission has expanded. Under the final rule published in July 2023, employers with 100 or more employees in high-hazard industries have to submit their 300 Log and 301 data electronically each year, on top of the 300A. ^[8] Employers with 20 to 99 employees in high-hazard industries submit the 300A only. Employers with fewer than 20 employees have no electronic submission requirement at all.

Miscounting recordable cases is the most common recordkeeping mistake there is. A recordable case is any work-related injury or illness that results in days away from work, restricted duty, job transfer, medical treatment beyond first aid, loss of consciousness, or diagnosis by a healthcare professional. First aid alone is not recordable. The list of what counts as first aid sits in 29 CFR 1904.7(a).

How does OSHA enforcement actually work?

OSHA inspects in a fixed priority order: imminent danger first, then fatality and catastrophe investigations, then worker complaints, then referrals from other agencies, then programmed inspections (planned targeting of high-hazard industries), then follow-ups. ^[9] Where you land in that order tells you a lot about how likely a knock on the door is.

Most small businesses only see an inspector after a worker complains, after a serious injury, or because they sit in a targeted industry during an emphasis program. Saying "we've never been inspected" is not a compliance strategy, though. The heat National Emphasis Program alone has generated thousands of inspections a year in construction and agriculture.

When an inspector shows up, you can ask for credentials and the reason for the visit. You can also ask that both management and an employee representative join the walkaround. You do not have to consent to a warrantless inspection. In practice most employers let inspectors in, because refusing usually pushes OSHA to get a warrant, and a warrant tends to produce a more thorough inspection, not a friendlier one.

After the walkaround comes a closing conference where OSHA describes any apparent violations. Citations and penalties arrive in writing, usually within 6 months of the inspection. From there you have 15 working days to contest informally with the area director, and 15 working days to contest formally to the Occupational Safety and Health Review Commission.

Settlements at the informal conference resolve most contested citations. The usual trade is some penalty reduction in exchange for a specific abatement timeline. Get qualified outside help (a safety consultant or an attorney) for any willful or repeat citation. That one is worth the cost.

What is an OSHA state plan and does it apply to my business?

Twenty-nine states and two U.S. territories run OSHA-approved state plans. ^[10] They operate their own occupational safety and health programs instead of federal OSHA. A state plan has to cover at least the same hazards and be at least as effective as the federal program, and it can go further. Cal/OSHA, for example, carries heat, silica, and aerosol transmissible disease standards stricter than the federal versions.

States with approved plans covering private employers include California, Michigan, Minnesota, North Carolina, Oregon, and Washington, among others. The full list is on OSHA.gov. ^[10]

If you are in a state plan state, your compliance obligations run to the state agency, not to federal OSHA. Federal OSHA still audits the state plans, but it does not directly enforce standards against private employers in those states.

Federal employees in every state fall under federal OSHA no matter the state plan status.

If you operate across state lines, you have to track both sets of rules. California and Washington have finalized heat standards today while federal OSHA has only a proposed rule. Run a crew in California and the 8 CCR 3395 heat standard is enforceable law right now, with its own temperature triggers and rest break requirements.

What OSHA training do employees actually need?

OSHA training is standard-specific. There is no single universal curriculum you can buy once and be done. Each standard that requires training spells out the topics to cover and, sometimes, how often refresher training has to happen.

A few examples:

• Forklift operators (29 CFR 1910.178): initial training before operating, an evaluation of each operator, and refresher training after observed unsafe operation, an accident, or a near-miss. No fixed refresher interval, but OSHA has said in letters of interpretation that periodic evaluation is expected.
• Hazard communication (29 CFR 1910.1200): training at initial assignment and whenever a new chemical hazard shows up. No mandatory annual refresher, but the training has to be hazard-specific, not generic.
• Lockout/tagout (29 CFR 1910.147): training at initial assignment, retraining when deviations turn up, and inspections of energy control procedures at least once a year.
• Bloodborne pathogens (29 CFR 1910.1030): annual training, full stop.
• Respiratory protection (29 CFR 1910.134): training before initial use, again annually, and whenever conditions change.

OSHA usually does not dictate the format (online, in-person, or hands-on), but the training has to be effective and understood by the employee. If a worker speaks limited English, training in a language they understand is expected. Handing someone a printed standard in English and calling it training will not hold up.

Documentation matters. For every required training, keep a record of the date, the topics covered, the trainer's name, and each employee's signature. Inspectors ask for these first.

If your supervisors need formal credentialing, the OSHA 30 card and OSHA 30 training are voluntary, but they show good faith in an enforcement proceeding.

How do I actually build a compliant safety program without a consultant?

The honest answer: it takes time and some care, but a non-expert can do it by working through it systematically. Nobody needs a $5,000 consultant to write a hazcom program for a 12-person shop.

Start with a hazard inventory. Walk your operation and list every task, every piece of equipment, every chemical, and every physical condition that could hurt someone. Use OSHA's industry-specific eTool resources as a checklist prompt. ^[2] For each hazard, look up the specific OSHA standard that covers it.

Then work out what each standard demands. Is there a written program requirement? A training requirement? A recordkeeping requirement? A specific engineering control or piece of equipment? Build your written programs to match the elements in the standard, not some generic template you pulled off a search result.

OSHA runs a free compliance resource that is separate from enforcement: the On-Site Consultation Program. Consultants in that program cannot issue citations and cannot share findings with inspectors. For businesses with fewer than 250 employees at a site (500 total), it is a legitimate free option worth using. ^[11]

To speed up the drafting, SafetyFolio's safety program generator builds compliant written programs for common standards in about 15 minutes instead of 15 hours of research. You still customize the output to your real operation and train your workers on it, but it gets the document structure right from the start.

The mistake most small operators make is writing the program once and never touching it again. OSHA expects programs reviewed and updated when conditions change, after incidents, and at minimum annually where the standard says so. Set a calendar reminder and actually keep it.

What are OSHA's rules on specific hazards like falls, chemicals, and electrical?

Falls are the leading cause of death in construction and a major source of injury in general industry. Fall protection in construction runs through 29 CFR 1926.502 (systems criteria) and 29 CFR 1926.501 (duty to have fall protection). The trigger height in construction is 6 feet. In general industry, 29 CFR 1910.28 and 1910.29 cover walking-working surfaces and fall protection, with a 4-foot trigger for most situations.

Chemical hazards fall mainly under hazard communication (29 CFR 1910.1200) plus substance-specific standards for the most dangerous materials. OSHA has dedicated standards for asbestos (29 CFR 1910.1001), lead (29 CFR 1910.1025), silica (29 CFR 1910.1053), benzene, hexavalent chromium, and others. Each of those adds permissible exposure limits (PELs), action levels, medical surveillance, and written compliance programs on top of the general hazcom rule. If your workers touch any of these, the substance-specific standard stacks on.

Electrical hazards fall under 29 CFR 1910.301-.399 for general industry. The lockout/tagout standard (29 CFR 1910.147) governs energy control when workers service or maintain electrical equipment. NFPA 70E is not an OSHA standard, but OSHA cites it in letters of interpretation as the accepted industry practice for electrical safe work, so meeting NFPA 70E is strong evidence of compliance.

Noise above an 85 dB(A) time-weighted average over 8 hours triggers the hearing conservation program under 29 CFR 1910.95: audiometric testing, training, and hearing protectors. Noise gets ignored in small shops all the time. A portable sound level meter is cheap and worth buying if your floor is loud.

Frequently asked questions

Does OSHA apply to businesses with fewer than 10 employees?

Yes. The Occupational Safety and Health Act covers nearly all private sector employers regardless of size, including those with 1 to 9 employees. The one distinction is that employers with fewer than 10 employees are partially exempt from routine recordkeeping (the 300 Log). They still have to report fatalities, hospitalizations, amputations, and eye loss, and they remain subject to every safety and health standard.

What is the OSHA General Duty Clause and when does it apply?

The General Duty Clause is Section 5(a)(1) of the OSH Act. It requires employers to provide a workplace free from recognized hazards likely to cause death or serious harm, even when no specific standard covers that hazard. OSHA uses it for heat illness, workplace violence in healthcare, and emerging hazards. To cite it, OSHA must show the hazard was recognized, likely to cause serious harm, and reducible by a feasible means.

What is an OSHA 300 log and who has to keep one?

The OSHA 300 Log is a running record of work-related injuries and illnesses. Employers with 10 or more employees must keep it, with exceptions for low-hazard industries listed in Appendix A to 29 CFR Part 1904. At year end, a summary (OSHA 300A) must be completed, certified by an executive, and posted in the workplace from February 1 through April 30. Records must be kept for 5 years.

What OSHA regulations apply to heat illness prevention?

As of mid-2025, there is no finalized federal OSHA heat standard. OSHA enforces heat through the General Duty Clause and a National Emphasis Program targeting high-heat industries. A proposed rule published in August 2024 would set triggers at an 80°F and 90°F heat index. California (8 CCR 3395), Washington, and Oregon already have enforceable heat standards, and employers in those states must comply now.

How long does an OSHA inspection take and what triggers one?

An inspection triggered by a worker complaint or a serious incident can run from a few hours to several days, depending on facility size and the scope of the complaint. Programmed inspections in high-hazard industries tend to be more thorough. The main triggers are worker complaints, fatalities and serious injuries, referrals from other agencies, and national or local emphasis programs targeting specific hazards or industries.

Can OSHA inspect my business without notice?

Yes. OSHA generally gives no advance notice, and giving unauthorized advance notice is itself a federal crime under the OSH Act. Narrow exceptions exist, such as when an inspection needs safety preparation or has to happen after normal hours. You can ask for credentials and the reason for the visit, but refusing entry can push OSHA to seek a warrant, which usually means a broader inspection.

What is the difference between a serious and a willful OSHA violation?

A serious violation (29 CFR 1903.15) is one where death or serious harm is substantially probable and the employer knew or should have known of the hazard. The maximum penalty is $16,550. A willful violation is one where the employer intentionally disregarded OSHA requirements or was plainly indifferent to worker safety. The maximum is $165,514. A willful violation can also trigger a criminal referral when a fatality is involved.

Do OSHA regulations cover remote workers or home offices?

OSHA's position, stated in a 2000 letter of interpretation, is that it will not inspect home offices and does not hold employers liable for home office conditions. Employers remain responsible for hazards they create or control in any work location. A work-related injury in a home office is still recordable if it meets the 29 CFR Part 1904 criteria. The practical enforcement risk at home offices is very low.

What written programs does OSHA require for a small manufacturing shop?

A typical small manufacturer needs written programs for hazard communication (29 CFR 1910.1200), lockout/tagout energy control (29 CFR 1910.147), respiratory protection if respirators are used (29 CFR 1910.134), a PPE hazard assessment (29 CFR 1910.132), an emergency action plan if you have 10 or more employees (29 CFR 1910.38), and a hearing conservation program if noise exposure exceeds an 85 dB TWA (29 CFR 1910.95).

How often does OSHA update its regulations?

There is no fixed schedule. OSHA publishes proposed rules in the Federal Register, takes public comment (usually 60 to 90 days), and finalizes after reviewing comments. The process often takes years. The construction silica rule took over a decade to finalize. The proposed heat standard was published in August 2024 and remains unfinalized as of mid-2025. OSHA also raises penalty maximums every year for inflation.

What is an OSHA letter of interpretation and does it carry legal weight?

Letters of interpretation are official responses from OSHA to specific questions about how a standard applies to a particular situation. They are not regulations and lack the force of law, but OSHA cites them in enforcement proceedings and courts often give them deference as agency guidance. They are public on OSHA.gov and are a useful way to understand how the agency will apply a standard in edge cases.

What is the OSHA On-Site Consultation Program and is it confidential?

The On-Site Consultation Program gives free, confidential safety and health consultations to small and medium businesses through state-run programs funded by OSHA. Consultants are separate from enforcement, cannot issue citations, and cannot share findings with inspectors. Employers with fewer than 250 employees at a site and 500 total are eligible. Finding serious hazards during a consultation means you have to correct them, but you get time to do so without penalty.

Are OSHA regulations different for construction versus general industry?

Yes, significantly. Construction standards sit in 29 CFR Part 1926 and general industry in Part 1910. Some standards match in substance but differ in specifics: the fall protection trigger height is 6 feet in construction and 4 feet in most general industry situations. Construction also has standards for specific trades (excavation, steel erection, demolition) with no direct parallel in general industry. If your crew does both, both sets can apply.

How does OSHA calculate penalties for small businesses?

OSHA starts with a gravity-based penalty (severity times probability), then applies reductions for size (up to 60% for 25 or fewer employees), good faith (up to 25% for a documented safety program), and history (up to 10% for no prior violations in the past 3 years). Willful and repeat violations get less flexibility. The initial proposed penalty is rarely the final number; most settle lower at the informal conference.

Sources

1. OSHA.gov, OSH Act of 1970 full text: The Occupational Safety and Health Act of 1970 covers roughly 144 million workers at 10 million workplaces and includes the General Duty Clause requiring a workplace free from recognized hazards.
2. OSHA.gov, Small Business Compliance Assistance: OSHA provides sector-specific compliance assistance tools and resources for small businesses.
3. OSHA.gov, Top 10 Most Frequently Cited Standards (Fiscal Year 2023): Hazard communication, respiratory protection, lockout/tagout, powered industrial trucks, and machine guarding are consistently among the most cited general industry standards.
4. Federal Register, OSHA Proposed Rule: Heat Injury and Illness Prevention in Outdoor and Indoor Work Settings, August 2024: OSHA published a proposed heat rule in August 2024 that would require written heat plans, water access, shade, rest breaks at 90°F heat index, and acclimatization plans; the rule has not been finalized.
5. OSHA.gov, National Emphasis Program: Outdoor and Indoor Heat-Related Hazards (CPL 03-00-024): OSHA's National Emphasis Program on heat issued in 2022 targets inspections in high-heat industries including agriculture, construction, and warehousing.
6. OSHA.gov, Penalties: For 2024, maximum OSHA penalties are $16,550 per serious violation and $165,514 for willful or repeat violations, adjusted annually for inflation.
7. OSHA.gov, Recordkeeping Rule (29 CFR Part 1904): Employers must report fatalities within 8 hours and in-patient hospitalizations, amputations, or eye loss within 24 hours; the 300A must be posted February 1 through April 30.
8. OSHA.gov, Improve Tracking of Workplace Injuries and Illnesses Final Rule (July 2023): Under the July 2023 final rule, employers with 100 or more employees in high-hazard industries must submit 300 Log and 301 data electronically each year; 20 to 99 employees submit only the 300A.
9. OSHA.gov, Inspection Priorities and Procedures (CPL 02-00-164): OSHA inspects in priority order: imminent danger, fatality/catastrophe investigations, complaints, referrals, programmed inspections, and follow-ups.
10. OSHA.gov, State Plans: Twenty-nine states and two U.S. territories operate OSHA-approved state plans that must be at least as effective as the federal program and can exceed federal standards.
11. OSHA.gov, On-Site Consultation Program: OSHA's free On-Site Consultation Program provides confidential safety consultations for small businesses with fewer than 250 employees at a site; consultants cannot issue citations.
12. Bureau of Labor Statistics, Survey of Occupational Injuries and Illnesses: BLS tracks annual work-related injury and illness rates by industry, providing the baseline data OSHA uses to target emphasis programs.
13. OSHA.gov, 29 CFR 1910.147 Lockout/Tagout Standard: Lockout/tagout is linked to an estimated 50,000 injuries per year; the standard requires a written energy control program and machine-specific procedures.